public void SPOptions_ModulePath_RejectsNull()
        {
            var subject = new SPOptions();
            Action a = () => subject.ModulePath = null;

            a.ShouldThrow<ArgumentNullException>().And.ParamName.Should().Be("value");
        }

        internal IdentityProvider(IdentityProviderElement config, SPOptions spOptions)
        {
            singleSignOnServiceUrl = config.SignOnUrl;
            SingleLogoutServiceUrl = config.LogoutUrl;
            EntityId = new EntityId(config.EntityId);
            binding = config.Binding;
            AllowUnsolicitedAuthnResponse = config.AllowUnsolicitedAuthnResponse;
            metadataLocation = string.IsNullOrEmpty(config.MetadataLocation)
                ? null : config.MetadataLocation;
            WantAuthnRequestsSigned = config.WantAuthnRequestsSigned;
            DisableOutboundLogoutRequests = config.DisableOutboundLogoutRequests;

            var certificate = config.SigningCertificate.LoadCertificate();
            if (certificate != null)
            {
                signingKeys.AddConfiguredKey(
                    new X509RawDataKeyIdentifierClause(certificate));
            }

            foreach (var ars in config.ArtifactResolutionServices)
            {
                ArtifactResolutionServiceUrls[ars.Index] = ars.Location;
            }

            // If configured to load metadata, this will immediately do the load.
            this.spOptions = spOptions;
            LoadMetadata = config.LoadMetadata;

            // Validate if values are only from config. If metadata is loaded, validation
            // is done on metadata load.
            if (!LoadMetadata)
            {
                Validate();
            }
        }

        public void SPOptions_DecryptionCertificate_EmptyWhenOnlySigning()
        {
            var subject = new SPOptions();
            subject.ServiceCertificates.Add(new ServiceCertificate { Use = CertificateUse.Signing, Certificate = SignedXmlHelper.TestCert2 });

            subject.DecryptionServiceCertificates.Count.Should().Be(0);
        }

        public void SPOptions_Constructor_LoadsConfig()
        {
            var config = KentorAuthServicesSection.Current;
            config.AllowChange = true;
            config.AuthenticateRequestSigningBehavior = SigningBehavior.Always;
            config.Metadata.AllowChange = true;
            config.Metadata.WantAssertionsSigned = true;
            config.ValidateCertificates = true;

            ISPOptions subject = new SPOptions(KentorAuthServicesSection.Current);
            subject.ReturnUrl.Should().Be(config.ReturnUrl);
            subject.MetadataCacheDuration.Should().Be(config.Metadata.CacheDuration);
            subject.MetadataValidDuration.Should().Be(config.Metadata.ValidUntil);
            subject.WantAssertionsSigned.Should().Be(true);
            subject.ValidateCertificates.Should().Be(true);
            subject.DiscoveryServiceUrl.Should().Be(config.DiscoveryServiceUrl);
            subject.EntityId.Should().Be(config.EntityId);
            subject.ModulePath.Should().Be(config.ModulePath);
            subject.NameIdPolicy.AllowCreate.Should().Be(config.NameIdPolicyElement.AllowCreate);
            subject.NameIdPolicy.Format.Should().Be(config.NameIdPolicyElement.Format);
            subject.Organization.Should().Be(config.organization);
            subject.AuthenticateRequestSigningBehavior.Should().Be(config.AuthenticateRequestSigningBehavior);
            subject.RequestedAuthnContext.ClassRef.OriginalString.Should().Be("urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport");
            subject.RequestedAuthnContext.Comparison.Should().Be(AuthnContextComparisonType.Minimum);
        }

        internal static SPOptions CreateSPOptions()
        {
            var org = new Organization();

            org.Names.Add(new LocalizedName("Kentor.AuthServices", CultureInfo.InvariantCulture));
            org.DisplayNames.Add(new LocalizedName("Kentor AuthServices", CultureInfo.InvariantCulture));
            org.Urls.Add(new LocalizedUri(
                new Uri("http://github.com/KentorIT/authservices"),
                CultureInfo.InvariantCulture));

            var options = new SPOptions
            {
                EntityId = new EntityId("https://github.com/KentorIT/authservices"),
                MetadataCacheDuration = new TimeSpan(0, 0, 42),
                Organization = org,
                DiscoveryServiceUrl = new Uri("https://ds.example.com"),
                ReturnUrl = new Uri("https://localhost/returnUrl"),
            };

            options.SystemIdentityModelIdentityConfiguration.ClaimsAuthenticationManager
                = new ClaimsAuthenticationManagerStub();

            AddContacts(options);
            AddAttributeConsumingServices(options);

            return options;
        }

        internal static SPOptions CreateSPOptions(Uri publicOrigin)
        {
            var org = new Organization();

            org.Names.Add(new LocalizedName("Kentor.AuthServices", CultureInfo.InvariantCulture));
            org.DisplayNames.Add(new LocalizedName("Kentor AuthServices", CultureInfo.InvariantCulture));
            org.Urls.Add(new LocalizedUri(
                new Uri("http://github.com/KentorIT/authservices"),
                CultureInfo.InvariantCulture));

            var options = new SPOptions
            {
                EntityId = new EntityId("https://github.com/KentorIT/authservices"),
                MetadataCacheDuration = new TimeSpan(0, 0, 42),
                MetadataValidDuration = TimeSpan.FromDays(24),
                WantAssertionsSigned = true,
                Organization = org,
                DiscoveryServiceUrl = new Uri("https://ds.example.com"),
                ReturnUrl = new Uri("https://localhost/returnUrl"),
                PublicOrigin = publicOrigin
            };

            options.SystemIdentityModelIdentityConfiguration.ClaimsAuthenticationManager
                = new ClaimsAuthenticationManagerStub();
            options.SystemIdentityModelIdentityConfiguration.AudienceRestriction.AudienceMode
                = AudienceUriMode.Never;

            AddContacts(options);
            AddAttributeConsumingServices(options);

            return options;
        }

        private static Options LoadOptionsFromConfiguration()
        {
            var spOptions = new SPOptions(KentorAuthServicesSection.Current);
            var options = new Options(spOptions);
            KentorAuthServicesSection.Current.IdentityProviders.RegisterIdentityProviders(options);
            KentorAuthServicesSection.Current.Federations.RegisterFederations(options);

            return options;
        }

        public void SPOptions_Saml2PSecurityTokenHandler_DefaultInstanceCreated()
        {
            var subject = new SPOptions
            {
                EntityId = new EntityId(entityId)
            };

            subject.Saml2PSecurityTokenHandler.Should().NotBeNull();
            subject.Saml2PSecurityTokenHandler.Configuration.AudienceRestriction.AllowedAudienceUris
                .Should().Contain(new Uri(entityId));
        }

        public void SPOptions_EntityId_SettingThrowsIfTokenHandlerCreated()
        {
            var subject = new SPOptions
            {
                EntityId = new EntityId(entityId)
            };

            subject.Saml2PSecurityTokenHandler.Should().NotBeNull();

            Action a = () => subject.EntityId = new EntityId(otherEntityId);

            a.ShouldThrow<InvalidOperationException>("Can't change entity id when a token handler has been instantiated.");
        }

        public KentorAuthServicesAuthenticationOptions(bool loadConfiguration)
            : base(Constants.DefaultAuthenticationType)
        {
            AuthenticationMode = AuthenticationMode.Passive;
            Description.Caption = Constants.DefaultCaption;

            if (loadConfiguration)
            {
                SPOptions = new SPOptions(KentorAuthServicesSection.Current);
                KentorAuthServicesSection.Current.IdentityProviders.RegisterIdentityProviders(this);
                KentorAuthServicesSection.Current.Federations.RegisterFederations(this);
            }
        }

        public void SetUp()
        {
            spOptions = CreateSPOptions();
            options = new Options(spOptions);
            //Substitute.For<IOptions>();

            options.IdentityProviders.Add(Idp());
            //options.IdentityProviders.Returns(ReturnThis());


            userService = Substitute.For<IUserService>();
            underTest = new Saml2BearerGrantValidator(userService, options);
        }

        private static SPOptions CreateSPOptions()
        {
            var spOptions = new SPOptions
            {
                EntityId = new EntityId(localMetaUri),
                ReturnUrl = returnUrl,
                WantAssertionsSigned = true
            };
            spOptions.ServiceCertificates.Add(new X509Certificate2(
                AppDomain.CurrentDomain.SetupInformation.ApplicationBase + "/App_Data/AzureApp_private_sha256.pfx","nomad_is_1593*"));

            return spOptions;
        }

        public Saml2PSecurityTokenHandler(SPOptions spOptions)
        {
            if (spOptions == null)
            {
                throw new ArgumentNullException(nameof(spOptions));
            }

            Configuration = new SecurityTokenHandlerConfiguration
            {
                IssuerNameRegistry = new ReturnRequestedIssuerNameRegistry(),
                AudienceRestriction = GetAudienceRestriction(spOptions),
                SaveBootstrapContext = spOptions.SystemIdentityModelIdentityConfiguration.SaveBootstrapContext
            };
        }

        public AuthServicesUrls(HttpRequestData request, SPOptions spOptions)
        {
            if (request == null)
            {
                throw new ArgumentNullException(nameof(request));
            }

            if (spOptions == null)
            {
                throw new ArgumentNullException(nameof(spOptions));
            }

            Init(request.ApplicationUrl, spOptions);
        }

        public void SPOptions_Constructor_LoadsConfig()
        {
            var config = KentorAuthServicesSection.Current;
            config.AllowChange(true);
            config.AuthenticateRequestSigningBehavior = SigningBehavior.Always;

            var subject = new SPOptions(KentorAuthServicesSection.Current);
            subject.ReturnUrl.Should().Be(config.ReturnUrl);
            subject.MetadataCacheDuration.Should().Be(config.MetadataCacheDuration);
            subject.DiscoveryServiceUrl.Should().Be(config.DiscoveryServiceUrl);
            subject.EntityId.Should().Be(config.EntityId);
            subject.ModulePath.Should().Be(config.ModulePath);
            subject.Organization.Should().Be(config.organization);
            subject.AuthenticateRequestSigningBehavior.Should().Be(config.AuthenticateRequestSigningBehavior);
        }

        private static void AddContacts(SPOptions options)
        {
            var supportContact = new ContactPerson(ContactType.Support)
            {
                Company = "Kentor",
                GivenName = "Anders",
                Surname = "Abel",
            };

            supportContact.TelephoneNumbers.Add("+46 8 587 650 00");
            supportContact.TelephoneNumbers.Add("+46 708 96 50 63");
            supportContact.EmailAddresses.Add("[email protected]");
            supportContact.EmailAddresses.Add("[email protected]");

            options.Contacts.Add(supportContact);
            options.Contacts.Add(new ContactPerson(ContactType.Technical)); // Deliberately void of info.
        }

        private static void AddAttributeConsumingServices(SPOptions options)
        {
            var a1 = new RequestedAttribute("urn:attributeName")
            {
                FriendlyName = "friendlyName",
                NameFormat = RequestedAttribute.AttributeNameFormatUri,
                AttributeValueXsiType = ClaimValueTypes.String,
                IsRequired = true
            };
            a1.Values.Add("value1");
            a1.Values.Add("value2");

            var a2 = new RequestedAttribute("someName");

            var acs = new AttributeConsumingService("attributeServiceName")
            {
                IsDefault = true
            };
            acs.RequestedAttributes.Add(a1);
            acs.RequestedAttributes.Add(a2);

            options.AttributeConsumingServices.Add(acs);
        }

        public void SPOptions_MetadataCertificates_OverrideDoNotPublish()
        {
            var subject = new SPOptions();
            subject.ServiceCertificates.Add(new ServiceCertificate
            {
                MetadataPublishOverride = MetadataPublishOverrideType.DoNotPublish,
                Certificate = SignedXmlHelper.TestCert
            });

            var result = subject.MetadataCertificates;
            result.Count.Should().Be(0);
        }

        public void SPOptions_MetadataCertificates_EmptyWhenNoneAdded()
        {
            var subject = new SPOptions();

            subject.MetadataCertificates.Count.Should().Be(0);
        }

 public void SPOPtions_ModulePath_Default()
 {
     var subject = new SPOptions();
     subject.ModulePath.Should().Be("/AuthServices");
 }